locked
Room mailbox acceptance\decline auditing ? RRS feed

  • Question

  • Hi

    I am trying to find out if there is a way to audit auto responses from room mailboxes. I have audit enabled on the room mailboxes it does not show relevant data. Looks like when you enable auditing it does on enabling auditing for owner, so I enabled it Owners as well using the command below but I still don't see any data

    Set-Mailbox -Identity RoomMailbox -AuditOwner @{Add="Update", "SoftDelete", "HardDelete", "SendAs", "Create"}

    I have auditing enabled on shared mailboxes and they do show data when certain actions are performed. Shared mailboxes are tied to Outlook profile so they are open most of the time where as Room mailboxes are not generally not opened from an outlook client or webapp. Does that have to do something with audit mailboxes. Because when I opened the room mailbox using an Outlook client to check meeting declines and acceptance and ran a audit report on that room mailbox from ECP, I saw some soft-delete operation when meeting was accepted or declined and the mail item got moved to the Delete items folder of the room mailbox.

    Basically, I am trying to see if there is a way to see X user submitted meeting request and was accepted or declined for Y conference room without logging into the conference room mailbox. Hope that made sense.

    Shiva

    Friday, April 5, 2013 1:20 AM

Answers

  • Hmm interesting. There's no backend or exchange auditing way to monitor this (to my knowledge, but I could be wrong - will check more)

    http://social.technet.microsoft.com/Forums/en-US/exchangesvrclients/thread/7fc9a816-02ed-4988-845b-3516cceafbad

    That being said, I could think of following workarounds that might be helpful:

    1. Assign delegate to room mailbox and disable auto accept/decline. Based on requirements that might not be feasible but a delegate who receives/accepts/declines meeting can try to keep track of it.
    2. Create a HUB Transport rule that copies message into a different mailbox sent and received by room mailbox. This way you can check the discovery or mailbox only and get count on daily basis.
    3. Create powershell script that counts messages sent / received by mailbox and filter for accept/decline as well. This isn't as hard as it sounds but this script can generate daily or weekly mail flow report for particular recipients or sender and put count in nice HTML report that you can either email to needed people OR save it on SQL as required.

    Auditing on items moved to deleted items or soft deleted by room mailbox "might" be one way you can audit how many meetings are being received by room mailbox but it won't be able to track accept/decline operation on those to my knowledge.

    http://technet.microsoft.com/en-us/library/ff459237(v=exchg.141).aspx


    AKL

    • Marked as answer by cara chen Monday, April 15, 2013 9:32 AM
    Friday, April 5, 2013 2:27 AM
  • Below is cmdlet or logic to track acceptance and decline sent by any given conference room:

    Get-TransportServer | Get-MessageTrackingLog -Sender <email address of room> -Start "4/4/2013" | Where-Object {$_.MessageSubject -like "Accepted*" -or $_.MessageSubject -like "Decline*" -and $_.EventID -eq "Receive"}

    Below is script I wrote for monitoring mail flow on every HUB server in environment and generate HTML report using same, you can try to incorporate above logic along with Import-Csv (which contains email addresses of rooms) into below script and you should be able to generate HTML file accordingly.

    http://exchangeserverinfo.net/2013/03/daily-mail-flow-summary-report/

    Hope it helps


    AKL

    • Marked as answer by cara chen Monday, April 15, 2013 9:32 AM
    Friday, April 5, 2013 3:34 PM

All replies

  • Hmm interesting. There's no backend or exchange auditing way to monitor this (to my knowledge, but I could be wrong - will check more)

    http://social.technet.microsoft.com/Forums/en-US/exchangesvrclients/thread/7fc9a816-02ed-4988-845b-3516cceafbad

    That being said, I could think of following workarounds that might be helpful:

    1. Assign delegate to room mailbox and disable auto accept/decline. Based on requirements that might not be feasible but a delegate who receives/accepts/declines meeting can try to keep track of it.
    2. Create a HUB Transport rule that copies message into a different mailbox sent and received by room mailbox. This way you can check the discovery or mailbox only and get count on daily basis.
    3. Create powershell script that counts messages sent / received by mailbox and filter for accept/decline as well. This isn't as hard as it sounds but this script can generate daily or weekly mail flow report for particular recipients or sender and put count in nice HTML report that you can either email to needed people OR save it on SQL as required.

    Auditing on items moved to deleted items or soft deleted by room mailbox "might" be one way you can audit how many meetings are being received by room mailbox but it won't be able to track accept/decline operation on those to my knowledge.

    http://technet.microsoft.com/en-us/library/ff459237(v=exchg.141).aspx


    AKL

    • Marked as answer by cara chen Monday, April 15, 2013 9:32 AM
    Friday, April 5, 2013 2:27 AM
  • 1. Is not an option in our environment. Too many conference rooms.

    2. Hmm.I will take a look.

    3. How can I filter for acceptance and declined messages ? Do you happen to know an example  of such logic.

    Lastly, huge thanks for taking the time to reply.

    Friday, April 5, 2013 3:00 PM
  • Below is cmdlet or logic to track acceptance and decline sent by any given conference room:

    Get-TransportServer | Get-MessageTrackingLog -Sender <email address of room> -Start "4/4/2013" | Where-Object {$_.MessageSubject -like "Accepted*" -or $_.MessageSubject -like "Decline*" -and $_.EventID -eq "Receive"}

    Below is script I wrote for monitoring mail flow on every HUB server in environment and generate HTML report using same, you can try to incorporate above logic along with Import-Csv (which contains email addresses of rooms) into below script and you should be able to generate HTML file accordingly.

    http://exchangeserverinfo.net/2013/03/daily-mail-flow-summary-report/

    Hope it helps


    AKL

    • Marked as answer by cara chen Monday, April 15, 2013 9:32 AM
    Friday, April 5, 2013 3:34 PM